2026 CVE Vulnerabilities
85,188 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1654 | MEDIUM | 6.1 | 0.3% | Feb 5, 2026 | The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_S... |
| CVE-2026-1294 | HIGH | 7.2 | 0.3% | Feb 5, 2026 | The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up t... |
| CVE-2026-1271 | MEDIUM | 5.3 | 0.3% | Feb 5, 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Ref... |
| CVE-2026-1319 | MEDIUM | 6.4 | 0.2% | Feb 5, 2026 | The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored C... |
| CVE-2026-25198 | MEDIUM | 5.1 | 0.3% | Feb 5, 2026 | web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vu... |
| CVE-2026-1953 | HIGH | 8.2 | 0.4% | Feb 5, 2026 | Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality... |
| CVE-2026-1268 | MEDIUM | 6.4 | 0.3% | Feb 5, 2026 | The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content fiel... |
| CVE-2026-1246 | MEDIUM | 4.9 | 0.5% | Feb 5, 2026 | The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'load... |
| CVE-2026-0867 | MEDIUM | 6.4 | 0.3% | Feb 5, 2026 | The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-a... |
| CVE-2026-1898 | MEDIUM | 6.3 | 0.3% | Feb 5, 2026 | A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/... |
| CVE-2026-1897 | MEDIUM | 5.3 | 0.3% | Feb 5, 2026 | A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/m... |
| CVE-2026-1896 | MEDIUM | 6.3 | 0.3% | Feb 5, 2026 | A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMig... |
| CVE-2026-25585 | HIGH | 7.8 | 0.2% | Feb 4, 2026 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color ... |
| CVE-2026-22038 | HIGH | 8.1 | 0.4% | Feb 4, 2026 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut... |
| CVE-2026-1895 | MEDIUM | 6.3 | 0.3% | Feb 4, 2026 | A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the com... |
| CVE-2026-1894 | MEDIUM | 5.4 | 0.2% | Feb 4, 2026 | A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js ... |
| CVE-2026-25584 | HIGH | 7.8 | 0.2% | Feb 4, 2026 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color ... |
| CVE-2026-25583 | HIGH | 7.8 | 0.2% | Feb 4, 2026 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color ... |
| CVE-2026-25582 | HIGH | 7.8 | 0.2% | Feb 4, 2026 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color ... |
| CVE-2026-25579 | MEDIUM | 6.5 | 0.5% | Feb 4, 2026 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users... |
| CVE-2026-25578 | MEDIUM | 6.1 | 0.3% | Feb 4, 2026 | Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site script... |
| CVE-2026-25575 | HIGH | 7.5 | 0.4% | Feb 4, 2026 | NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path... |
| CVE-2026-25547 | CRITICAL | 9.2 | 0.5% | Feb 4, 2026 | @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-ex... |
| CVE-2026-25546 | HIGH | 7.8 | 0.9% | Feb 4, 2026 | Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a... |
| CVE-2026-25543 | MEDIUM | 6.1 | 0.2% | Feb 4, 2026 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now